Search the public rule index by CVE, GHSA, CWE, language, framework, author, or rule slug. Filter by language, framework, severity, confidence, license, and validation status.
A credential-bearing integration row reaches the client response without redaction. Integration configs are write-only credentials: Slack access tokens, incoming-webhook URLs, webhook header values (Authorization bearers) and `enc:` ciphertext for S3/GCS keys are persisted in recoverable form so the delivery worker can read them raw, and `read` on a project
Untrusted template code is compiled or evaluated with Function/eval in the host realm instead of a hardened VM realm. Compiling a stored template with new Function() in the worker's own realm, and handing it the host payload object by reference, lets $payload.constructor.constructor resolve to the host Function constructor and execute arbitrary code (sandbox
A value is interpolated into the SQL text of a SELECT/JOIN expression as an identifier: an identifier list (`${...join(', ')}`) inside a SELECT subquery, or a raw `${name} as alias` select term. SQL identifiers cannot be neutralized with value escaping, so a crafted filter, breakdown or property name can terminate the enclosing subquery, supply its own FROM/
A deserialization routine reads a parsed node's element list ($NODE.$FIELD) and consumes its `length` to size an allocation or bound a decoder loop without first verifying that the list is a real Array. Because the node comes from untrusted deserialized input, an attacker can substitute an array-like such as {"length": 2000000000} or {"length": "Infinity"}:
A sequence/iterator object is constructed from raw deserialized node metadata ($NODE.s throw index and $NODE.l done index) without first validating that both are in-range integers. An attacker who controls the serialized payload can supply an out-of-range done index so the reconstructed iterator never reaches its done condition; application code that iterate
Deserialized value $VAL is laundered through a TypeScript type assertion ($TYPE) instead of being proven by a runtime identity check. Untrusted serialized input can place an arbitrary object (or a plugin-produced value) behind the deserialized value, so downstream consumers invoke attacker-chosen methods on it (e.g. `on`, `next`, iterator protocol). Validate
Caller-controlled data reaches the command text of a PowerShell execution without allow-list (whitelist) neutralization. PowerShell - unlike a POSIX shell - normalizes Unicode typographic quotes (U+2018-U+201E) and dashes (U+2013-U+2015) into real string delimiters, so a character blacklist that strips ASCII metacharacters still leaves alternate delimiter gl
KaTeX is configured with `trust` bound to an inline boolean (or the literal `true`) instead of a per-URL validating callback. A boolean `trust` enables the trusted LaTeX commands (\href, \url, \includegraphics) for the whole render without any URL protocol decision, so KaTeX writes the author-supplied URL verbatim into a[href] / img[src]; KaTeX escapes attri
Auth adapter/provider hook methods are installed with a direct bracket-read copy ($ADAPTER[$KEY] = $OPT[$KEY]) that resolves the prototype chain and is neither filtered to own properties nor checked against the base adapter class defaults. If the configured adapter is a class instance extending the base adapter class and only implements the granular hooks (v
Auth state is persisted with `req.object.save(...)`, which writes back every client-supplied field of the login request body, not just the recomputed MFA authData. An attacker can mass-assign arbitrary user attributes (roles, ACLs, points, etc.) while exercising the MFA token flow, because the save runs with `useMasterKey: true`. Save the server-loaded objec
A query representation is built from only the branches of a `$or` operator and returned as the query's identity. Every constraint stored beside `$or` (a server-injected per-user ownership pointer or a beforeSubscribe/tenant filter) is silently dropped, so distinct subscriptions collapse to the same key, are merged into one subscription group, and events (inc
A URL path is passed to path.basename() BEFORE decodeURIComponent(), so percent-encoded separators (%2f, %5c) and dot segments (%2e%2e) survive basename() and only decode into '/', '\' or '../' afterwards. The decoded file name can therefore contain traversal segments, and joining it onto a base directory with path.join() resolves the destination outside tha
Server-side fetch() with redirect: "follow" on a non-literal URL performs an outbound request with no destination-host restriction. When the URL is derived from request data (e.g. a user-submitted domain), an attacker can make the server fetch loopback, private-network, or link-local/cloud-metadata addresses, and redirect: "follow" additionally lets a public
$FUNC authorizes a caller-supplied service/project id without ever verifying that the target resource belongs to ctx.session.activeOrganizationId (missing object-level tenant authorization, CWE-639/BOLA). It only resolves the caller's own member record, applies role/RBAC statements via checkPermission, and enforces the per-user allowlist solely for non-owner
The SSRF proxy's request hook returns a connection config without a `dnsLookup` pin, so the proxy performs its own DNS resolution when it opens the outbound socket. The hostname guard evaluated in this hook (e.g. rejecting hosts that resolve to private, loopback or link-local ranges) therefore uses a different DNS answer than the one the connection actually
Request-controlled data is signed with the application-wide JWT secret, turning this code into a signing oracle: the requester can obtain a validly-signed token whose claim set they fully control (id, role, orgId, billing, expires, provider, ...). Because the same signJWT/verifyJWT pair with one shared secret and no token-purpose marker backs sessions, organ
A value classified as a local file reaches a filesystem read without canonicalization and containment validation. A stored, user-influenced media path (recorded from a request and later prefixed with the upload directory) can contain `..` segments or be absolute, so the worker reads any file the process can access and the provider then uploads those bytes to
The fetch-URL guard for $HOST is a string denylist over `URL.hostname` that ends in an unconditional `return true`, so it fails open for any host encoding that is not listed verbatim. Canonicalization defeats exact-match checks: `http://[::ffff:127.0.0.1]/` becomes hostname `[::ffff:7f00:1]` (hex groups), and `[::]`, `[febf::1]`, NAT64 `[64:ff9b::...]`, 6to4
A client-echoed MCP elicitation `requestState` is promoted into the caller context (`elicitState`) on authenticity verification alone. That state is minted BEFORE the `elicitation/create` confirm leg is asked and is delivered back unchanged for accept, decline, cancel and malformed/omitted answers, so a verified echo proves only that the resubmission belongs
A SQL string literal is built by interpolating a value into a single-quoted literal while escaping only single quotes, so backslashes pass through unescaped. Dialects that process backslash escapes in single-quoted literals (Amazon Redshift, MySQL) parse an embedded '\' as an escape: the doubled quote becomes an escaped quote followed by the literal terminat
Incomplete SSRF gate: the hostname is resolved with lookup() without { all: true } and only the single destructured `address` is passed to the private/reserved-IP check. A hostname whose RRset also contains a private or reserved address -- or whose answer changes between this check and the connection (DNS rebinding / check-to-use) -- passes the gate, so the
SQL query string built by splicing $VAL inside a single-quoted SQL literal ("...'" + $VAL + "'...") or by quote-wrapping a value ("'" + $VAL + "'"), then executed via $DB.query() without a parameters array. A single quote in $VAL terminates the SQL literal, so an attacker-controlled value can inject arbitrary SQL (node-postgres sends a single-string call ove
A record read from the shared verification store is trusted without any purpose or shape check: the lookup uses a raw flow-local identifier and the record's stored value is destructured straight out of an unchecked `JSON.parse($RECORD.value)` (e.g. `const { email } = ...`), and those identity fields then drive authentication (user lookup / account creation m
Incremental execution results are merged into the shared execution result at a path taken verbatim from the incremental result without checking that every path segment is a safe object key. A hostile segment (e.g. "NaN", "__proto__" or "constructor") turns the write into an arbitrary-key store such as data.NaN or a prototype-pollution write, and the per-item
